Safety evaluations only work if behavior under test predicts behavior in deployment, and evaluation awareness threatens that link. The usual way to monitor for it is to read the model's reasoning for statements like "I am being evaluated." But verbalization is a witness to evaluation awareness, not the phenomenon itself. The words can disappear while the policy remains.
We test whether evaluation-conditioned behavior actually depends on verbalization. Concretely, we study controlled coding model organisms trained to use Python type hints more often in evaluation-like contexts than deployment-like ones. Type hints are not themselves a safety concern. They give a clean, automatable behavioral marker, so we can ask whether the behavior survives once the model stops announcing that it recognizes the test.
When we suppress every detected verbalization of evaluation awareness through on-policy resampling of the reasoning trace, the behavior does not go away. In the primary Llama-Nemotron organism the eval/deploy type-hint gap falls from +28.5pp to +7.0pp with zero detected verbalizations, and a Qwen3.5 replication preserves a much larger +65.3pp suppressed gap. This shows that evaluation-conditioned behavior, explicit verbalization, and internal representations of evaluation context are separable.
A linear probe trained only on non-coding eval/deploy contrasts transfers to coding tasks it never saw in training, and it stays predictive on the same generations where no awareness language survives (response AUROC 0.81 in Nemotron, 0.71 in Qwen3.5). The signal that the model is being evaluated remains readable in activations after the model has gone silent.
This suggests that reading the reasoning trace is not enough on its own. Non-verbal evaluation awareness is a concrete monitorability failure mode that verbal monitoring misses and activation-space analysis can still catch. We read these results as an argument for layered monitoring, where verbal indicators stay as strong positive signals and activation-level readouts cover the cases where the model does not say what it knows.
Type hints are a proxy behavior induced by the model-organism setup, not a direct safety outcome, and the probes are readouts of an eval/deploy context direction, not evidence that the model believes it is being evaluated. Within those limits the result holds across two model families.